This invention relates generally to monitoring functions useful with the Windows(copyright) 16 bit operating platform.
In a number of program monitoring applications, including scanning for viruses, it is important to prevent file execution prior to the monitoring operation. Other examples of monitoring include metering, protecting access and the like.
U.S. Pat. No. 5,257,381 to Cook teaches the use of an interceptor function for intercepting calls to global functions. Global functions could include file manipulation functions, such as open file. After interception, the interception function calls a monitoring function, such as a virus checker.
A variety of virus detectors exist which have various deficiencies. For example, some virus detectors are not adaptable to the Windows(copyright) 16 bit operating platforms. Systems which use virtual device drivers (VxDs) are effective in Windows 95(copyright) applications but may be subject to deficiencies when applied to other platforms. For example, the VxD virus detectors may require two copies of the virus checker to be stored. This is because the virus checker and the VxD may operate in different address spaces. As a result, a large amount of memory may be taken up by the two copies of the virus scan engine. In addition, some of these virus checkers may only allow re-booting of the system when a virus is detected.
One desirable attribute in certain monitoring functions is that they be foolproof. By foolproof it is intended to refer to the ability of the software to prevent access by another file that may otherwise bypass the monitoring function. A program would not be a foolproof monitoring function where it allows another file to be opened without monitoring, which might include scanning for viruses in particular applications. When other open calls can get through without being hooked and monitored, it is possible that viruses could infect a given system, causing adverse consequences.
Thus, there is a continuing need for a foolproof monitoring function which does not require duplicate copies of the monitoring function and which is applicable to the Windows(copyright) 16 bit operating platform.
In accordance with one aspect, a method of monitoring that is useful in Windows(copyright) 16-bit applications includes obtaining the address of an open file routine. The code at that location is compared to expected code. Control is transferred to an interceptor function when an attempt to open a file is detected.